052025aac86dcf7255618a6d38557f696870f946c1c550d8ad45235de1d28941

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Size 1.9MB
Sample260507-lpbbnsay5t
SHA256 052025aac86dcf7255618a6d38557f696870f946c1c550d8ad45235de1d28941
MD5 1f8b540e55d6b48f7b1d1f7d04ad07b3
SHA1 510f70374c210d6b8f006e056030c94898585b4f
SHA512 9bd3af5f1056d113ef2ef325cc275efec1c8934711bf90615cf9d602a03a87c554fe25c5ae04f4153a31671b6babd64f0ca86e830dddb964df941ad3b066e7dc
SSDEEP 49152:cKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjwLNiXicJFFRGNzj3:cKjKWQckVgtev5mnlNL87wRGpj3
TLSH
T1FD95234172D08070F5F61A349970D4B45BBEFD389931995753992E2E6F38AC2EA38B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2536	alg.exe
592	DiagnosticsHub.StandardCollector.Service.exe
1332	fxssvc.exe
4304	elevation_service.exe
5080	elevation_service.exe
4616	maintenanceservice.exe
1400	msdtc.exe
3492	OSE.EXE
1756	PerceptionSimulationService.exe
4124	perfhost.exe
1472	locator.exe
1716	SensorDataService.exe
1156	snmptrap.exe
3216	spectrum.exe
3664	ssh-agent.exe
4368	TieringEngineService.exe
1580	AgentService.exe
3240	vds.exe
1876	vssvc.exe
1844	wbengine.exe
4460	WmiApSrv.exe
4416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\731aaa9c14bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMD726.tmp\GoogleUpdateSetup.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD726.tmp\goopdateres_es-419.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD726.tmp\goopdateres_hu.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD726.tmp\goopdateres_zh-TW.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000767a8ccc05dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000742a9dcc05dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007020d0cb05dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016f8e7cb05dedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b77c4ecc05dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f6a3bcc05dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b0f9ecb05dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
592	DiagnosticsHub.StandardCollector.Service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2148	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	1332	fxssvc.exe
Token: SeRestorePrivilege	4368	TieringEngineService.exe
Token: SeManageVolumePrivilege	4368	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1580	AgentService.exe
Token: SeBackupPrivilege	1876	vssvc.exe
Token: SeRestorePrivilege	1876	vssvc.exe
Token: SeAuditPrivilege	1876	vssvc.exe
Token: SeBackupPrivilege	1844	wbengine.exe
Token: SeRestorePrivilege	1844	wbengine.exe
Token: SeSecurityPrivilege	1844	wbengine.exe
Token: 33	4416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeDebugPrivilege	592	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4304	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1532	4416	SearchIndexer.exe	105
PID 4416 wrote to memory of 1656	4416	SearchIndexer.exe	106
PID 4416 wrote to memory of 3288	4416	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3996

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4124

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1716

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1156

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3216

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2792 2452 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1656
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2844 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa74a8a676442fd6af7522b35fb77a6f7c29d8789a6a4342a4c769b446196baf
MD5 394372ebfa4ce21fbf95cf151f7e0ea9
SHA1 e4729972f0fad900e7350defb1180ebd5f05270a
SHA512 3fca8a8a6350f2ce610500d5c52db497249ddf97034630323aaac9f8016b062f24ca11e60c0e30ac0d94c3cbe95f76cd7d6018251e43ea18aa0b8438c1175c65
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnXLNiXicJFFRGNzj3:z3q6mjBQ7wRGpj3
TLSH
T104D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 77b2c4c7d338ebab4224deeaea291f59ea333484943d6990d9e90a310addfe42
MD5 127d51defbcdc70b1a7f2e5acb0648bd
SHA1 ed9e9b1d6b46885889f253d1f611cfc079647a01
SHA512 0ca76ed2eed0c894e457b1cd1cb7dca80a9bb55538c57f3182e7bd8f171c76f69c8c0beb68bf06c266e348b9f69a20526d65937ad4544ea9cbaaee8841f87424
SSDEEP 24576:fXYfDtczAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qtctLNiXicJFFRGNzj3
TLSH
T15675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1480cac5405872e4f2cd0e2417fec1b8c6b2b742a0fc6e40a634047ac599a88a
MD5 9e0b64c518b9bfcb094542802e1f8550
SHA1 143fe9693ce6ffd3f53e07ee31a1dca8d56c6789
SHA512 2cefec38a4c682e854d05806b94e3b10595ac7e14e87f3a75707c665c32fbd4a8866e826307d75db65f34d44be48507b87ad17f3957bb0e425005e6aecd07e79
SSDEEP 24576:U0Le5ji0hmxhrMP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UPji0Az+LNiXicJFFRGNzj3
TLSH
T10885AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 75de2fb3948f4998f16fa77fba17ec7924921e7397570fad778e2421aeb24d6f
MD5 58ab2bf5be2622e0d2e9ded3d661cd35
SHA1 62737d3e1b94e056c03ce05df2d8b897ef4c1e73
SHA512 a892fd348e0e3a48eafd16c5f43730958c6acc4374d81709897e051d5683326f24f53c2debb361f03d89af3f26a2998b93fe237faebbc7668ea0e2519d45c9ef
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyu9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/ezSC6vUzPv+HjyKLNiXicJFFRGNzj3
TLSH
T1F7756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 df64d2de2c7c4b7ebceab1f08a0e780222a09ebefdd03d680fe18eaedbb21cb2
MD5 222e2012769c1514c40b4d6af7f747d3
SHA1 fa4b4e0fd87f4adb132f4ef8c157909919b32730
SHA512 810cd90f45f89f510a7858a708d1c67c2b1c33ae68a8e496377ece94a7cd39ae9811522db14e99401d601f2358e7642c2d4576c83788d676a2bec05de8c6b146
SSDEEP 24576:TVbqPb88hv/l+Bg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TVO88hXl+eLNiXicJFFRGNzj3
TLSH
T1C1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E67BD6C736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4412360b579bb375758ee4975b4e0cf6eec87f3c9cfbfe3cbf4a94f4397b09b9
MD5 8e7c7e33f683e3222dc7c481bdfe6a7e
SHA1 b0b55f392b5d45073aa5bfb406fc2f59a202f820
SHA512 33aaab60853390a2bfdf1a935b65acbc526db8679d2b353de2fb4a1075ac92055f106018e5d86db70417e89e98c2701ce69bf9f90267020245aa535bb09d5fd1
SSDEEP 24576:yGD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NLNiXicJFFRGNzj3
TLSH
T19B5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c9f12025a20d2a62d673dbe8385a580fdb0f93b9122a5e913e4152965a75d81f
MD5 a1091d2772fd19467a09bba19538efc6
SHA1 6140da1476aaa94c6388c8cc4714a172e1b83f41
SHA512 cef7b7305a6b063f9d82148bd3a37d5decb65d7211f1988d3c4bdde78bb852bb2c71121ca8dc78c00cc9a169fef3da5a6baa8a4d5a2c642af7954f262690ba89
SSDEEP 24576:VJIUY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VJIUYLNiXicJFFRGNzj3
TLSH
T15C75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 db4adedf9356bc8db70a1cac2942232c0c8d6907dc29639104f7f0fb34564288
MD5 7a4678098415d8d9ab4cb4f230d3381e
SHA1 897411dda474f91ce45cce98afabafa1eb9d7daa
SHA512 e6ce0939d0cfd3dd7b4360b12deda31bb81d4ab02f5637e1bdfd276735032be0c9f1f396b76efc40d0955a1c12500c48bf95558d714c138935bc7aeb6812a292
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:XQvGAdlCEL8c/WRNw5CN7wRGpj3
TLSH
T134266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1b1da23fb630205ec42652862870abe766f2130353ca4d8b3d32b8a208335963
MD5 ae7169f9c9cbc2fbd70588b593aeffe3
SHA1 7177e3dffa842d0acdc98f70742478eec44005ce
SHA512 b60f54f8de20f4c5ad1c6ebe77509fb41fc8538e104848502011d4f57ceb5663161ad991df68f9ed94b798d67e64dd16ae83b816f2046d163a356fe643fa7c14
SSDEEP 24576:XfewsAjO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PljOLNiXicJFFRGNzj3
TLSH
T11875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 146657fdb06b0853851b0e33b6a9cc6fa9a836131785d8173a31f737133c7e1f
MD5 9d58090f63cc9229613bf9b904f69b4b
SHA1 7f27f5585cfab6bec2bf9726514fdadea06ad78f
SHA512 626d3234c5c5a83c4af816dfbd66d1b1d9ec423097983671e6ef91fe29396fc3750af77f0c5fc36e7b94444e26a2888de79fa33fddb2a83fac06c8d63ccccdbe
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHaF9:PUEtQevvqc2W1cpV20I32e9
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 981e8e7ea12e87bb3d520c38b3e0dd20c3e742fb324a6d1bed35955f6e0be3ba
MD5 b7720b39a19a97f13d2d38895ee251af
SHA1 cc75f219c394fabfcb6c399241124bd4e9a3e360
SHA512 5ad3750a09e12d8b29f8849c1dd8c6694c47bbd09125bcd0fc1a2e64707eeed68a76ec156e1f9897fb643cf392141523c674ae7c2c777b021f6154b1dc14c406
SSDEEP 49152:jCbRquA/m2yL5zLfFiV+XenmE3/zuLNiXicJFFRGNzj3:coq2Vjnm57wRGpj3
TLSH
T18FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d9cda3cf15a7a3de45c746080b6fd9d71e7c5d9609531abe6af1372ec1c0614f
MD5 9ece36501c712cfc6fb55878d661e9c7
SHA1 eec62cd02ae1399ccc18800baf0cd28532447d8d
SHA512 5b83d7df0c6d073e08eaee20c3ef95ce2d52a4bf53ad4433d962776504be24ccf8c15f0da928cb104091032beee974fcfde13de135b41c362f7cb07b9e75cbb4
SSDEEP 24576:TAhGL6IFoiwtA5l7S53Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TAM5Foiq5JLNiXicJFFRGNzj3
TLSH
T157359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 de79544c7573beb103af0baa10ce6134284e100290fe85172ccfaa6702f4b172
MD5 1f6941889bce65c14cab6b6105432865
SHA1 255db2abb08769d091ac78953561bd5d98b45e3d
SHA512 589c72a987db9ec8905b8c05f16cee943b35892a9cbb9ef721b342df05da183dadc64cbc3a5b1aa12797b0bf7e3712b68190180ab9bcfd8f636d13dfd5ce0f8c
SSDEEP 24576:6wuROWq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6wSOVLNiXicJFFRGNzj3
TLSH
T1BC65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6acc142675f968a973f22615e250d792921ad68964d12301d33eaf5d6c81d4a9
MD5 a5403fa35c2de932923498f25e7d551b
SHA1 41afcbc75b26d5d4d64b77199795980722cdd962
SHA512 f7ab78cb2afb50e678c6e632c478d65468e6422dac723e78ab60d28f1af6dba50e9c91ae398c9668f3a3ff9cc2804e8be27472c29218e1c51a4ab15b4b4a042a
SSDEEP 24576:pZun/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gLNiXicJFFRGNzj3
TLSH
T18455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c502ae0d8c4f06bd36b6ceee944340acc8536f9ab35f7b21090e2b2e197211bc
MD5 e07ab109da8cbba010eb579374a3046a
SHA1 cfe880b89cdb18d19c3bf87f04996e2f29f35969
SHA512 66c15508f856eb6f94e0db15449b7203c9781ac2246fa8df244d657855a3de887ffbd4c32144dc106a36efbe5bfe6449acb7fa2ec4edb50d7142201c22576202
SSDEEP 98304:0QRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:bQyiKanX+PNgF9
TLSH
T1D4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 487b12056adf5a2678ea8526ba425b1c0bd63b783834125bd08d15a2f0350163
MD5 71e27fed7ef980ad43d0bdfa33bca159
SHA1 1857e2841c7b567ac1a9567aa823d3c9a09324f6
SHA512 d758809cd6d6f0b0bb6a4519dc701c81a5b98ea8b7c1e23621abaa2c884d30a7b6ddb532ff2349988dff9a2745023d0ece44956aecc8600b20d1a5f6180d2cd6
SSDEEP 98304:7QRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:KQyiKanX+PNgF9
TLSH
T15C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 14840b41c2afaca65f27063f67f8984f3272a4ba523827905e65e8e85cb9d86a
MD5 a3ed271e9f8a1be39c51e0fcadb9de1a
SHA1 d29bbca5f21a0480ecf8f1b03a4dc7fef07cc1ca
SHA512 d6347d25126bf7c033749bae120369f931809a9b767e4d80516e76091ba736e3b18ae5a1646f78233d6d8928c0f417edd64947e865e2e7452d0b2150c64e54b4
SSDEEP 49152:868Qg55nhkeWu7PNU3/+LNiXicJFFRGNzj3:2thTRc/+7wRGpj3
TLSH
T182B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ce856b47c9402442dad20a65b74675d2aaf72e8ef712a546f1f6fb281392b45a
MD5 97cb8fe04e4092c1dca1f0a93674480c
SHA1 1369410171b446e29749a1c872d2196b1648b1a6
SHA512 0ffe52be0f3ba99b3bacc1ee7e1cccb0b19bf1f1a12ac7eff50fe35de942ab697a385ab297d4b9f83c8731f628bae6a5ac6fe87ae7fcc29005e5d0bba365482d
SSDEEP 98304:0y5112gYy5azzVvU69nLKnhZD7wRGpj3:1LIHRWhlF9
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f3a7b065d3289b8fcf142695ec009c48d62d9009a7be932aa1417b50b141e4b
MD5 d63c9b8c3b501f36582c56eff986ed6f
SHA1 7212d3cfdb0d01c7c632a0305af7c895b9f2816d
SHA512 ee3f77b0aeb57bccf4a6a2b64155d43541d2eb02ee780306f29c324831814cd15f8fee9d1c69ca01632ec15a7a179f03d8e039eb107b40410924c963b6c965c0
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glcLNiXicJFFRGNzj3:mu6JmIxd2dc7wRGpj3
TLSH
T128D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 38838c7dc13b9cbe2afbde4fb4509c93754c032a5fba18e14d1349dc82ebe673
MD5 fe8b7c3227e079650a34705a684454ca
SHA1 b42f5bea45e09917ba4a91434ce090577bff679b
SHA512 493f7bfbd37c3f258c8e933ff0f9dc7feae0d0cf7f1e027d8f3f57ccf5eb74018b8b81f1de0c7595685cd2b2421113a59a21ae25c5a12de03a78cb3d02454d95
SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4x4LNiXicJFFRGNzj3:+mifPqR57wRGpj3
TLSH
T15CB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f79246e2ddcefa268d95cb954a05bb22687c217ca3f163e66d476e40658e3a8c
MD5 133f5c28ec0f8f0fdbb5211f4d87298d
SHA1 586c50989d928608def018bad7cc8a25044f770c
SHA512 ce1d7cf7412a83c8aee33cf758075b902cbd023e25cee00a9e312bed17bc42d3fc95c3b48aa59558bd936275e3c96945cac4c2259eba9ce652a7375346fb0207
SSDEEP 49152:KSuZQIY0Be2KkRVtOnks6NMHqnLNiXicJFFRGNzj3:U5dKqi61n7wRGpj3
TLSH
T115C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 554b23376e8a8003fb4aaa1d3f41fc01638919aecc661b8ebd9d374cc4cf59ca
MD5 795530256b7107916170adfb507c3d12
SHA1 d755438f11cbf4b2887bac75ac868c9f7cbff285
SHA512 05708fe7a80461acc662fb01b9486dc2ed06b51b8d36989ed9674371aa2b76514a6925f619fc9ed5f934286b4a03fe9366777443b3897538829e0c3229d3e385
SSDEEP 49152:RhtSn8EApI0figjgiDn0AP5wsLNiXicJFFRGNzj3:AX2iWph17wRGpj3
TLSH
T16395BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 693a429698881813096bb41dabea9ef0e336e2b73debe3c229dd9a45b840871e
MD5 baac0f84e3acd03de09ef5cc64eaeaa0
SHA1 440ed0a30bb393bd8e5c042511642e151c050f9d
SHA512 2d9f803a39ccb6c6e9ca2d0e7657bbe99fb284a03ff4f08f65cac0fd7843fd9f6d5d47c79e1eaf3bc2f150090163411302395928c10c7b59d0ba7772fa2c7c2f
SSDEEP 12288:lviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 524eb5ae6fe0aa01b04c813da30b0df8b11ce6c45d7a066961a99b7979b3afe7
MD5 2e1c5092c8e3e7dfec466061ee7578dc
SHA1 cacd29148dd34e5f6b1fffbe64dfb71f60950353
SHA512 2673c488284749d09c162edf14ac6c3b670e6e966e1125115862ab0415fc16cb946447ed28fb96a153d4056a5321349db37d4399663a43688cfa33c8d09ea791
SSDEEP 12288:HAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3548945B1FABC0039C6764428F5882E2DDB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 58d9bc90683a13f7bc750ea4f4d58a6486a75fb8aca72e0a095c3de9b20d931e
MD5 6af60ce4dedcb44a2d0f6f05f6c09ec3
SHA1 d0d3999ca32086eed19fdc93cae6b9c0609c4bfb
SHA512 e88d71798fbb4b5d9bd83de2e6c67047e092fd498ed67d4b75bfdadf5d7c26c6747f019166be732d29435568a2f8cb97241a8a1289cf89d2710134eb37f8dd74
SSDEEP 12288:VmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f16b4b89005e01e404818aaeb6414b1fcf968af6c969db9877f1d33c167e1466
MD5 24c478e186d1b225e1604dec1de2b333
SHA1 228968deaa4445c2fa4ce4a800dfbc6fa104d73f
SHA512 120a1353b749e0c0d569fe1cc9004b86ce2be73067a95a75903b5cb5ee98b24dfcb2d01c96076e9fcf26624e6a86c63854918fe6e6bf67e4441a565128d34be4
SSDEEP 12288:MVViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T182552393168900F1E9FD803DC6764424F2947D6CD7325AEBD3003D1E5A75BEA9F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f819782f718b469ea6c8af64087ef623f06fb16bc9a8d36a8d55662f247a7272
MD5 3b0283e5f4c97a56e333900cdb81f89c
SHA1 1bf86a6f6f9598f2c8e850fc2dd2bf1fd416c263
SHA512 0f53a934102154952f06c93f897f4aa17b7bcecdf6045da25eb9ef3fbc89a3c5467d6c8b6ef590abdae7ee84c83dab5844f17ba90cebb9c30d7696bd7adfcc8c
SSDEEP 12288:bdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9753c5fd3bc259174e8c3c64f98538e45405eb674e586709becbdc804c1ff2ec
MD5 1dc1c303c3878eae3c5956b1f4d8c4e3
SHA1 b0c9272aa820559348b2b6186517e0e1669755a0
SHA512 41b7b1c1b59bda56dc870e6b12ed75dc18869280ca3bc4e1770f95c27ed7e493898f5a89577b33730aa6d01b74b7ae887a66b0882fa5498acc18a8a694c106a4
SSDEEP 12288:mciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3443D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 635a031c26e08d6c9a518c08dc0ae4c2e0b0a932144c8e1f1406fa36bc4edfc7
MD5 97a5ad24804980a5e2c7e825bf40d625
SHA1 cc83e510cc281ba6c0f6b4e68af56848d3778630
SHA512 da0e8615f6cd7d4dcd0e8c25b1e4f61e550cfcdd0e484a06e563658e6487d1871d7239da0643d350d66c9ef68b05ed6270ff2401915788029fbddbe40bda68a9
SSDEEP 12288:5oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1FABC0039C6754428F5882E2DDB6659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f7431f8c6c93464000df5578252c6edd3aafd4d173dd8a334be70c918081e631
MD5 937a2864627021c64eecf77600058c9c
SHA1 fc72837e9e9feb3b6a035e5a2c0f942dada1bd9a
SHA512 8e7e791bd815a38b8cb27e56f3dd41cbab1069b9fab6ef71ce30ab14989f516ef481bccd5b0abb5c9092ebe9475b7fe3ff754cd8a8088256c2421b792d8e7a25
SSDEEP 24576:hZM3zFVSOy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hZM3zf2LNiXicJFFRGNzj3
TLSH
T187750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d0f480222e1732ec4ddd571276a2ae1a0fc97830721c9db5cbe4d2426529b810
MD5 e7af3eeb0139731a59945b4c008f633b
SHA1 5b01dfc0ef47053c2877cc65506aa13a77e7f3ab
SHA512 239406372deff317a2ff7de995f91c719e60c6998d23ff1463e46e54557502685448c21f4e8a093600842b9d0613a005280e13c4cc8dce7416b6d4527170975d
SSDEEP 12288:4DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:43/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1FAFC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7955ef8b5a981dc10c7a4aaf71ecd8c5454d7236f85aa3b1f3d2b3f0e1836305
MD5 c19326cd8037f13573ed70f9085e62b0
SHA1 8870734ad300d54a95cfa60a873aeee26f76612c
SHA512 cf9422a37b589670d428bb0e9014640672a8b1665eda3357f92052b7f5606dcacd2865c91674f8846304a8e121c10cac03b8bc1984948a5f03a8e5c6da80331e
SSDEEP 12288:HniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 003824a9e9ff62675ca1c1fc454bdc0e5e3c89199697b7bbca95ead7a4bab265
MD5 35af1e5d2b76c2e2b4b50bf0f33cc039
SHA1 aaf07f2c9086c7058aaf6d244246468630c1b4fa
SHA512 2ecb3ebf5cbf5d52ef69cd8d628d5ab6283788cc8072640f52d0d540ed64e5204feae2e5e4d24e321574945513f7d5bf6954bd9a14175bad8204fc1ec75e5fff
SSDEEP 24576:jzye/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j1LNiXicJFFRGNzj3
TLSH
T1CA650243629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f143d82f51427d7392318a66f7f9e6a856cce783b4476fc2888c17d40d4abc69
MD5 3e8bd2fcb569bbf293b3af8fdbe842db
SHA1 6473067d6aae4db093bbd7c2d60ed7521ef89c2c
SHA512 c8a73746bca395d72c295fe57240bdd619a27c3f62a2572b9441b0579ab5869059af4607d607ee289c72ca54221071a6542f889046c867a1ee6b6ad35420ae67
SSDEEP 12288:ADiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2da007be6eb1cc2b493ef56434e569c0de304297077598178ae2c7823e714d4a
MD5 771c5700b3aaa2074c22af93b98026de
SHA1 37bfa9a6775cd04f66a8bae408345b69cfac41a8
SHA512 c9395e22ce1fd4a8e2de3ddd79efc05e9186472f08cf1e383ff9ba4b5f2415e2e394a952f78209f8fd8c81f45b3d2f00a1ef510425a6affc5740a066afa18535
SSDEEP 12288:ADiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523D3548955B1FAFC003D86364428F5882E2DDB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e5ca3f92fc26817bf47270da6eaeaa622756bc860aff77cf12bd294b022f1a7a
MD5 aed327909d6860fdd4c3f3d28dfa9511
SHA1 8c558552e321156752aedf06b65d89afddfe83a1
SHA512 1d6c4f48d4ef190617f705956f911dfa66fd3e2069c7f60e601e6720166c79b87d804a5c308f4c0a4395dc3a03bd7dcb5e819f1fc259785098503494de4edb8a
SSDEEP 24576:3zye/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:31LNiXicJFFRGNzj3
TLSH
T12E650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 72b04bd4611f8b041617e19a29d6e6d9847601ffc7f361ba4f56fe17b6e5bce0
MD5 68596f886f722c3a10c8b02134f5ba5d
SHA1 54daa03db4708ffbacb5596e29dfb4525647c56e
SHA512 f2e428ee7fb79d872c155d9807a3b4ebccd8d614b777fc071e32486875d32528f96ea5b922e2d2ba2834ab579efaaec8959b2e9450df23b94a81a8d7f3e35516
SSDEEP 24576:yCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA0/TwSfVcYG3K/cJHlnFR+IGe:yCUAPTY+8Wg2lIL8lrIUJLWwBLNiXico
TLSH
T1D365BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8701f1bed61534972165223e8a9268291811a45d0c6275478b18f029d74caabd
MD5 6056fd0e8c7d2736c998cf9d427ef73c
SHA1 5bcb4c13888909d70e29ecf98042bf2e7345bade
SHA512 d8d4dc1fcc63bb2fa3cbcc22d1903da90574ecdd1ea51419663f0e14c153c48679f60c7ec380cedf6f29f31fffbfb12979e431e02b5542d691c0e03b2e858ed3
SSDEEP 12288:1psfTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 299360024de2daf31b1ec88459bc562dfb71e3e0ec1154cbece64f6d30d1edea
MD5 31cfe53e0e9e433aa3cfdeb6440afe0f
SHA1 694e958383fc64c91802af34de35def897b5d4f9
SHA512 095920db748c059a2e7759acc70a6912fd9c21f78989ee471f6010d2c6fb3094faf21d2788f8febcf553f4e83910e53961d456541ade909f36cca10cdb934461
SSDEEP 12288:oGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ow/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D9552392428C59A1FAFD1039857A9438B64C7E2C9F1558D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8757fa89e4aa221049a60adfa8e70ce73b989f3d60a2b5ca006c536940d908e2
MD5 0e2f4f4fb9d75b50b97089a83675be42
SHA1 e10184ffade509171c1c80ff4ddb1d6549724375
SHA512 74d8828a97724538ffc471e13981a26401e67c59a791a93c5e64d187141855eccc00d121567bdc14af838d77e993140d2d858e150f0f66bf59d4e021472cc13f
SSDEEP 49152:iRZwQCyiHiQEaaPnMvLNiXicJFFRGNzj3:A9xvPC7wRGpj3
TLSH
T19685B01E62DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ee5abfa04abe7046aa5b33074b8e61e6fbb4dda11cd52efe5b52729614fca8d1
MD5 9f465339627cbec65bdde6f965f80e88
SHA1 a4785e714a3236325fa753bc04f62a49e9781422
SHA512 6226c6c68a0a00f513fb471013f1658f3b1392d8fb0ee89bc0c4031d97324da4132d1ab0ea64fac432ee5cceead35218f00ee6388eff6bcbf59c00ab1402e24a
SSDEEP 24576:hbxA1UGA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hbxA1UbLNiXicJFFRGNzj3
TLSH
T10855126E129C14F0F5B9903D89A68005E3317C2A572197EF6180927E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f81988be79d4b2d4f93fe2d28449ebad0a52b82c01b686e54cc46cfea43cd6b3
MD5 1f6ea9f06c9f1a26f9b9436fd34cb4ae
SHA1 d532c9ef7945de2402e9a791630e1b4b32cf6716
SHA512 608ac40814e98827ed623791f9e7045f9a8ba2d593f9eca5165cfde585fe82e5682283c363df3c084c7a2b51a98273a02e06ca5c13547712b8f591f42528a16c
SSDEEP 24576:/jsmP0yHaqrVqHra44KDzMsrnJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/jRP0yHfVqzlAsrnJLNiXicJFFRGNzj3
TLSH
T18945AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 bc22b06d1033a60aa656597ac16040150dad422c4f88d1644c6a1d339f1c9f99
MD5 11f06aa15ad2294006ed9b8c085eb1ad
SHA1 fb3d22af6d56372fbe68fac39178b1afa68c72ee
SHA512 aa9412e6d6e862da52b1c5179f92577189cde90129421d988a39976aff1edc7ebe10560a1f64c0e23fcade7dce9990c63cff0c61d18da0741fe768511eb7ec72
SSDEEP 12288:a8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D2518955B1FAFD003D867A4428B5486F2C9B2619E3E1443E1EA27CFEFCF38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6555376570d8589a19b1e8c7b614446b17670ce646b8d22984d5f432e42ff901
MD5 49e656812ecfab80ed4fb4e419dbff06
SHA1 ba309bbedaf8300dd4a10bdc332b05fa9381c785
SHA512 1a58846e4dced34ad7fca1828bd1f6721556ef299174cc6ac2b8d66e87898975de44885962557771d0350216a24ecbc8d0aaba8b70bfa15df1200b02d33b152c
SSDEEP 24576:cALBUTs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cALBUYLNiXicJFFRGNzj3
TLSH
T1D2750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e182bbc4384dd8065550d5b6b05fdbedc8f5e7dac207dc861ec1188d24a8ff45
MD5 8a237e6ccd3098b281a3194f4f97e75c
SHA1 64c812d0ec3d95000246df522b9439a2f5ce5b0f
SHA512 be344c07191bf6fdf042260af5ab1cfca0890a9359ad40913a8ad659792496ff876125859f08bdcfe890f8442dac3273484514e5cbf1dddbffaf1d521c8c2860
SSDEEP 24576:TfYNHF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TfYtFLNiXicJFFRGNzj3
TLSH
T1F665F12F62AD18E4E57B913D8A838109F2727C66171192DF01A0827E1F27FE9BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 80cb54a3ad107bff3b0cd917dde8a8b63700673a2b9650c2edaf31acc155147b
MD5 8b0578730dbabd6f37aa8ebff40a351e
SHA1 7388b2720d6b2c23ee68c831b8d4d8aa11d038f2
SHA512 4217062bb8a4e1f71ee1d00943af059c14ad4ab2930b14ca31c1ede5ea2f189e6656cbc7bd398f05e459cd0be5be143af0ff3d61cb2c58972cab1d96f351177f
SSDEEP 24576:ynXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:ynXoJJYH84VVS6AmETJas+cHBjSSKHPU
TLSH
T1E165BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 638eded14cbee08744c8b7095a564bf2b1a974e3c9994275e7f124e653d8f1d1
MD5 f5c1dc37cce80e2c8ed7d43bea5cc0b2
SHA1 5699fb11baab39678e3ced0a9a365abda645f9e0
SHA512 fec3c3638409f9afefe46614ac1af6877d370b2a798fc7f8796d2d699c0c09d7667be9bee6bb840aaafe3f9e8a6e624f3760f2a152721d7d7d4b3ffd7eef8901
SSDEEP 49152:8DLL9TuJ0M/TYW2PmLNiXicJFFRGNzj3:ft7wRGpj3
TLSH
T1F5858D5EA2EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 dc60f68b3c98f8a89c91d1ac36544458a910de594785992a428c7882c56094a1
MD5 3434aa4f0f18fee94dc2409fe8badaef
SHA1 1a407e91d4aed87d818af61f9f54aa25d07db2ff
SHA512 02c46f1f3e4dfdecc0be3c692748a43cc89ee615df4427ba7b6982269f7e36d22f0a41f7e23a01dedd2452d1783044f3b90f4bb75228545f951d7a47217a1e21
SSDEEP 24576:UegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10ws/TwSfVcYG3K/cJHlnFR+IGNe8j3w:UngOJOmPOHksLNiXicJFFRGNzj3
TLSH
T17355CF3FA7BC15D5E07EC13D8A968816F6B1782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 2b29a11ae6d26789f2db60731064936193a3f2194c5993090e4b3e5e7aac910e
MD5 428e05c2b3ea50e47d65338a229d1938
SHA1 4406eeed8d86027f3e5f3670186cdb8221fbcf9b
SHA512 13dc6d2b6af6e43d400737f82301defb56386f2e7ff65379246c8e6e7541cac18fbcdd0454f269b684faa5a8dff78f21d72cc64d4f24f7e215abd38f70466150
SSDEEP 24576:MLJnJiTk3R3waE4JrOm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLJnJK8R304l5LNiXicJFFRGNzj3
TLSH
T1E275E07DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 20de3708ecaa7d2e54f147139809f25cfa08b8204967f92d879dbe808739a790
MD5 050327d668148beef290cec048d68685
SHA1 ba5c0d26ea2d6c51b5e456c3d07d880ba2568856
SHA512 3b82374303d64384ad0fc15b883848c3e57bb132abf529d77492060a8cd3ec9408a7bd8274d524c229b1503bea16de004adb15c60a684baa28ad5679128386b8
SSDEEP 49152:C9GqCzDScAZmlvTcFg8Ph6aLNiXicJFFRGNzj3:cl7wRGpj3
TLSH
T1C1955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 dbf02b9170690dff289e5fe5f6a85abdb811e1b9f35852397ec8194ed584ac6e
MD5 ea22b1ed1d9dfb884da4f16fe1f25037
SHA1 e1d1750afd8bff5a3d3a2e3e9054e256dc58ee92
SHA512 74317aefbb9e4903170e0fb484512edceb4f55cd4c5e8e19beb12a3e0990b5558a84e2f84aaf2e140dbe75d7d70ae5a34c4025f7bba4c3e9b826b92f995b6c3f
SSDEEP 24576:BlYJeXm5jUuE8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BlYJeXmRUuE8LNiXicJFFRGNzj3
TLSH
T10055129E268C30F1E27E803D85A24414E361B879571217FF91E0A57E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 76d00640254bf7383aa2e1d0dbe993b1a61be901e464632aa621fd9194025f8e
MD5 ab1a8b0b3a34986020d5f0e0ea3b87a0
SHA1 ce71439b6de52dd2408f5c106ff8fd0b7c6e36ea
SHA512 0facf9622a683dacc4a863096433802486cccaa3f4f82ef7b3cf8762d3d259188f7fa7b2b650d3410005738f081e5bee5120ea0e194955b4e369b56b50c0ccdc
SSDEEP 24576:DVtyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVtCLNiXicJFFRGNzj3
TLSH
T1D265124122C465E4EABD053CCA734064EA747C249F2157EF9190BA3F6B36FD5AE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 610c32b37dd8f09b8e15628081ac89aa408c936cea7d8be13822361b11dfc770
MD5 aa4f4aca249e4225599bfdc81f6414c0
SHA1 a57eb63bbef614bcd56850c08bc8494371cba750
SHA512 d0b100ae755917aae66fd29e3a5203660dbdafdd3f14808e252e4c87a61f4378422c8a89d1119bbae0c71be784cf2407fe7c29589c36be57bf94299c9521b805
SSDEEP 12288:vPqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D6118965B1EABD003D86364424F1887E3C9B2528F7A194793ED379FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 de51ca253ca70d70a8949468f46c65b76759be2177347a878df3e51ea806f26d
MD5 90ee72085d4f05e915b313828a833a13
SHA1 e8a02fecd648b11c8c778b51f9023f5b7eab331e
SHA512 1c6ee405c0c3ba228cc59fdc6ebc7631f609eacacb7b3565628ec8fc841c1a38ec39fb608697545cbad8120fcd7e2557be4a5d2e83346e3aa4398935986f9f5d
SSDEEP 24576:kC+TyQIu93VAumZr7jmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k/TfIq+YHLNiXicJFFRGNzj3
TLSH
T130558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f1b7115f6a47e3fede9d2c67eaf4ee3d97e04d8f6662eaf63582fcee3159568f
MD5 cc113cf26736f74e8491815a13cbd936
SHA1 3cb4e3220fa5ff328461de4248f3cc772d38a731
SHA512 7d9f36f07c159e99dfd14173346e1f827c8ec3fba23452ef34a2bff6e50596bf013796077d70c2e27a34cd22315ef9698c4cb4c37e932e488ccc63031ace60af
SSDEEP 24576:hLQikZI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lQikOLNiXicJFFRGNzj3
TLSH
T14F65F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5896a9bb08d2ff77c36ef0c8af4d2558cf218ba1a286806319b335a1efd3193f
MD5 fab4f252e651d69c6c989cc390621cc4
SHA1 1215f9850859e7ac640a352a432a5de2e51fc787
SHA512 cb216fbfc908ad4d3d49e50573ef9b92c168052d7178ffa3dfc33b7f57b93c9b6260562102e1b152a17e62d0c955735b17e78048ca636ec540614dc11f9f1ff5
SSDEEP 49152:4pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPpLNiXicJFc:JpC7b4+80GTki7wRGpj3
TLSH
T1C2A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f1061741d557e590eaf3465edc328d4319aa3272321c62d566387cbb52c7c5e4
MD5 f7e1cadaf1628da299a522df7d1d5d2b
SHA1 cda1b3a0041999dc29d65f280622911f559dde78
SHA512 c8f712908243f249824a8c9305cca3869d3efe5eb646474a997cd5700180c27ed4cb34ddaca57fdc887fd4517742de4652b7641273d58ecd77d7f6392c1f3472
SSDEEP 24576:nSAwJPE1IDAo+4Kt+l4413lUQh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nqPCIo4Kol4jQhLNiXicJFFRGNzj3
TLSH
T15C55B02AA7F956F4E17AC774C663C511FB727822133163CF9290913E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d5e3186d201eaea6570385bce1e7cfd00097baa13e9aaf74c02642463f734045
MD5 11537741e8c5100465eabe8883520768
SHA1 a1152bde19e85a15b0610e9fb0e48618e31d3321
SHA512 da66f4bb2ccce86863bd98364d0139e02b68737b0ddab36cdcd812f524e9fc377d5238fd130ac784e702f14216a49d69131c631ff0d09685d84ecae7a3030007
SSDEEP 24576:KyLXPLcT94tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ky7PoqtxLNiXicJFFRGNzj3
TLSH
T18D75D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 63222259cf8b45ea9843eb16ea58d1f23a1ddfa491ba43e5499f1d6ede5d232e
MD5 6137ab5800695b01d56117d6f8dc9ddc
SHA1 2cf3b9bd57495b89763e5648e8c5075e3dc4c35e
SHA512 13d5af7c2449c92ec7b653e34772e77823197dfb242c59cfc16732cf0bb9fab1821b963a6e97e6fcc1cc9875b51ddffae056baba01699f91fc0109a8d7ebde3c
SSDEEP 24576:/Wv8qjp4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/Wv8ZLNiXicJFFRGNzj3
TLSH
T13765129E12C424E4F5BD4138C636802490B17D3A17655AFFB1C4A97E8739BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/592-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/592-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1156-196-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/1332-97-0x00000000011B0000-0x000000000129A000-memory.dmp

Download

memory/1332-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1332-98-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1400-223-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1400-139-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1472-178-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1472-245-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1580-219-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1580-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1656-525-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-510-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-496-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-497-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-512-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-514-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-498-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-499-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-531-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-511-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-530-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-529-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-528-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-527-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-526-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-501-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-524-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-523-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-495-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-500-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-522-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-521-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-509-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-520-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-519-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-518-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-517-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-516-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-515-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-513-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-508-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-504-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-507-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-506-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-505-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-503-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1656-502-0x000001E30BF60000-0x000001E30BF70000-memory.dmp

Download

memory/1716-246-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1716-490-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1716-194-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1756-153-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1756-159-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1756-171-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1844-492-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1844-231-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1876-228-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1876-489-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2148-1-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2148-453-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/2148-8-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2148-150-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/2148-0-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/2536-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2536-172-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3216-491-0x0000000001760000-0x000000000184A000-memory.dmp

Download

memory/3216-290-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3216-192-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3216-195-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3240-444-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3240-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3492-147-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3492-141-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3492-151-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3664-200-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3664-206-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3664-210-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3664-426-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4124-173-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4124-168-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/4124-163-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/4304-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4304-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4304-209-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4368-215-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4368-443-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4416-493-0x000000000B9D0000-0x000000000B9D8000-memory.dmp

Download

memory/4416-243-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4416-561-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4416-267-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/4416-251-0x0000000001C90000-0x0000000001CA0000-memory.dmp

Download

memory/4416-288-0x000000000A580000-0x000000000A588000-memory.dmp

Download

memory/4416-250-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4416-237-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4460-235-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/4460-560-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/4616-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4616-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4616-136-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4616-123-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4616-214-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5080-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5080-118-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5080-112-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5080-213-0x0000000140000000-0x00000001402D4000-memory.dmp

Download